ListingPro vulnerabilities

Unauthenticated SQL Injection exists in ListingPro versions <= 2.9.10.

The ListingPro plugin in versions up to and including 2.9.12 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.

The ListingPro plugin versions up to 2.9.10 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.

Missing Authorization vulnerability in CridioStudio ListingPro theme allows exploiting incorrectly configured access control security levels. This issue affects ListingPro from n/a through <= 2.9.9.

DOM-Based XSS vulnerability in the ListingPro plugin allows injection of malicious script into the page generated by the plugin. An attacker can exploit this to execute script in the victim's browser.

The ListingPro plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.9.8.